A comparison By Nick Jang, founder · checked 30 October 2026
OSFI E‑23 software, side by side.
The platforms Canadian banks and insurers look at before E‑23 takes effect on 1 May 2027, each described from its maker’s own page. We make one of them, MINERVA, so read our row with that in mind; nothing here is a rating or a ranking.
01 The platforms, in their makers’ words
Paraphrased from each vendor’s public page on 30 October 2026. Follow the link for the vendor’s own words.
| Platform | What its maker says it does |
|---|---|
| SAS Model Risk ManagementEnterprise model risk suite | Centralizes models in one inventory with tools to document, review and validate them across their life cycle, with dashboards on model risk concentrations for senior leadership. Listed under the SAS Viya platform. sas.com |
| IBM OpenPages (Model Risk Governance)GRC platform with a model risk module | A GRC platform bringing risk, compliance and audit into one system; its Model Risk Governance module offers traceable workflows and reporting. IBM says it is available on any cloud or on premises. ibm.com |
| ValidMindModel documentation and validation | Publishes an E-23 implementation guide that maps the guideline to its model inventory, documentation, validation and ongoing monitoring features; its documentation lists a multi-tenant cloud and a virtual private deployment. docs.validmind.ai |
| YieldsModel risk management platform | Describes an inventory with the attributes E-23 expects for in-house and third-party models, risk tiering that sets review depth and frequency, lifecycle workflows to decommissioning, monitoring with thresholds and escalation, and an audit trail. yields.io |
| ModelOpAI lifecycle governance | Presents an Enterprise AI Command Center as a system of record for machine-learning, generative, agentic and vendor AI that automates lifecycle management and enforces governance. modelop.com |
| Lumenova AIAI agent governance beside an existing inventory | Extends an E-23 model inventory to AI agents and the MCP servers, skills and prompts they use, alongside the existing model risk system: tiered approvals, evaluations before and after launch, limits enforced before actions run, and exportable decision records. lumenova.ai |
| Mitratech ClusterSevenSpreadsheet and end-user computing risk | Finds and oversees spreadsheets, Access databases and similar files outside IT's control: one inventory, change tracking, rule-based risk scoring and audit evidence; listed under EUC and model risk management. mitratech.com |
| MINERVA StudioThe record and the controls for E-23, B-10 and AI agents | One inventory of models, AI systems, AI agents and vendors in E-23 and B-10 terms; approvals that refuse the model's own developer and wait for the evidence its rating calls for; agent policies checked before each tool call with held calls and a kill switch; a hash-chained, time-stamped record an examiner verifies offline. Hosted in Canada or on premises, English and French. minerva.studio |
02 Six kinds of tool
- Enterprise model risk suites
- Inventory, validation and reporting for large model estates, often inside a wider analytics platform (SAS).
- GRC platforms
- Model risk as one register beside policies, controls, issues and audits (IBM OpenPages).
- Validation and documentation tools
- Model documentation and validation testing, with an inventory around them (ValidMind, Yields).
- AI lifecycle and agent governance
- Machine-learning, generative and agentic AI from inventory through operation (ModelOp, Lumenova AI).
- Spreadsheet and EUC risk
- The spreadsheets and end-user tools that hold models nobody registered (Mitratech ClusterSeven).
- Record and controls
- The register, the approval rules enforced at the moment of decision, AI agents and vendors on the same record, and evidence an examiner can verify (MINERVA).
03 Make every vendor show you this, on your data
- The inventory
- Import your own spreadsheet and show which E-23 fields each model still owes, vendor models included.
- Separation of duties
- Try to approve a model with its developer as the approver, and see whether the system refuses or only records it.
- Evidence before approval
- Try to approve a high-risk model with validation evidence missing or a high-severity finding open.
- AI agents
- Show one agent's policy, a call it refuses, a call it holds for a person, and who can stop it.
- Vendors
- Show a third-party model's supplier, its reassessment date and every model and agent that depends on it.
- The examiner
- Export the evidence and have someone outside the project verify it without the vendor's systems.
- Deployment and language
- Where the data lives (Canada, your cloud, your data centre) and whether every screen works in French.
- Price
- A written price for your register's size and what a pilot costs.
04 When MINERVA fits, and when it does not
It fits when the gap is the record and its controls: an inventory in E‑23’s fields, approvals that refuse the developer and wait for evidence, AI agents and AI vendors on the same record, and evidence an examiner can verify without trusting us, hosted in Canada or in your data centre, in English and French.
Look elsewhere, or alongside it, if you need hosted validation compute (MINERVA’s tests run in your environment through its SDK), a full enterprise GRC suite for every risk type, or discovery of spreadsheets across the network. MINERVA is a young company and has no published customer case study yet; a 30-day pilot on your own inventory is how to judge it.
05 Questions people ask
What software do Canadian banks use for OSFI E-23?
Institutions preparing for E-23 look at enterprise model risk suites (such as SAS Model Risk Management), GRC platforms with a model risk module (such as IBM OpenPages), model documentation and validation tools (such as ValidMind and Yields), AI lifecycle and agent governance tools (such as ModelOp and Lumenova AI), spreadsheet and end-user computing tools (such as Mitratech ClusterSeven), and record-and-controls platforms built for E-23, B-10 and AI agents (MINERVA Studio). Many pair two of these.
Is any software approved by OSFI for E-23?
No. OSFI does not approve, certify or endorse software, and E-23 is principles-based. A tool can hold the inventory, enforce the controls and keep the evidence; whether a programme meets E-23 is for the institution and OSFI to judge.
How is MINERVA different from ValidMind or Yields?
ValidMind and Yields describe themselves around model documentation, validation and the model lifecycle. MINERVA is built around the record and its controls: approvals that refuse the developer and wait for evidence, AI agents under policies checked before each tool call, third-party vendors under B-10 on the same record, and a hash-chained, time-stamped trail an examiner verifies offline. MINERVA does not host validation compute; tests run in the bank's own environment through its Python SDK and are recorded against the model.
Can a GRC platform handle OSFI E-23?
A GRC platform can hold the model register and its workflow. Check whether it rates models in E-23's terms, blocks approval until the evidence is on file, keeps the developer away from approval, and covers AI agents and vendor models; many institutions pair a GRC platform with a model risk or AI governance tool.
Which tools govern AI agents under E-23?
Lumenova AI and ModelOp describe agent governance among their features, and MINERVA puts each agent under a written policy checked before every tool call, holds high-risk calls for a named person, gives a named holder a kill switch and records every decision. OSFI's July 2026 technology risk bulletin on generative and agentic AI lists the practices to look for.
What does OSFI E-23 software cost?
Most vendors quote on request. MINERVA publishes its prices: a 30-day pilot on your own inventory for CAD 15,000, credited to year one, and a subscription of CAD 36,000 to 150,000 a year by register size with unlimited seats.
Who wrote this comparison?
MINERVA Studio, one of the vendors listed. Every other platform is described from its maker's own public page, linked beside it and checked on 30 October 2026; none is rated or ranked. If a description is out of date, write to minerva@minerva.studio and it will be corrected.
Read more: OSFI E‑23, explained · Choosing AI governance software · Agentic AI governance platform · AI vendor risk software. Product names are their owners’ trademarks; MINERVA is not affiliated with any other vendor listed.